Security Questionnaire
Last updated: September 13, 2026
This page answers the questions we're asked most often when someone is evaluating Center Desk Drawer. For anything not covered here, reach out. We're happy to answer directly.
Company & Program
Where is Center Desk Drawer hosted? Vercel (application) and Supabase (database, authentication, file storage), both established infrastructure providers with their own security programs.
What security framework do you follow? Our practices are organized around the NIST Cybersecurity Framework (CSF) 2.0. Full detail is in our Security Overview.
Do you have SOC 2 or ISO 27001 certification? Not yet. We're an early-stage product and haven't pursued formal third-party certification. We'd rather be direct about that than imply a certification we can't back up with an audit report.
Data Handling
What data do you collect? Account information, a student's first name and last initial, and reading activity generated through normal use of the product. Full detail is in our Privacy Policy and Data Retention & Deletion page.
Do you collect parent or guardian data? No, not even through the family link.
Do you sell data or use it for advertising? No, never.
Who are your subprocessors? See our Subprocessors page, kept current as the single source of truth.
Access Control
How is access controlled? Role-based, enforced at the database layer using PostgreSQL Row Level Security, not application logic alone.
Can your staff access our data? Only when necessary for support. We're a small team and don't yet have a dedicated audit log of that access the way a larger company might; we intend to formalize this as we grow.
How are passwords handled? Hashed by our authentication provider, never stored in plaintext or viewable by anyone, including us. We don't currently check new passwords against a breach database.
Backup & Recovery
Do you back up data? We rely on our database provider's own infrastructure-level durability rather than a separate backup system we maintain ourselves. See our Security Overview for detail.
Incident Response
What happens if there's a security incident? You'll be notified without unreasonable delay after we confirm an incident.
Legal & Compliance
Will you sign a data agreement for our school or district? We don't have a standing agreement in place today, since Center Desk Drawer isn't currently sold to schools or districts directly. We're glad to work with you on what your evaluation requires. Contact us.
Do you comply with FERPA? See our FERPA Commitment page. Because Center Desk Drawer is typically adopted by an individual teacher rather than a school, the usual "school official" exception may not automatically apply the way it would for school-licensed software; we explain what that means on that page.
Questions Not Covered Here
Reach us at hello@modelb.app. We're glad to walk through anything specific to your review.